← Back to Threat Briefs

Cyber Threat Brief — November 7 2026

⚠️ This report is AI-generated. Always validate findings.

1. SonicWall SonicOS SSL-VPN — CVE-2026-19868

TL;DR: CISA added SonicWall SonicOS SSL-VPN CVE-2026-19868 to KEV, while SonicWall describes its investigated report as potential exploitation. Prioritize affected SAML-enabled gateways and review alternate-method logins for users required to use SAML.

What’s New:

  • The bypass requires valid credentials for an alternate authentication method and affects SSL-VPN configured for SAML. It may also bypass SAML-enforced MFA.
  • CISA added the CVE on 6 November and set 20 November as the remediation deadline. SonicWall’s potential-exploitation wording does not establish zero-day use or reveal an attack chain.
  • SonicWall’s fixed-software table gives separate upgrade floors for Gen7 and Gen8. Apply the matching generation’s fixed build listed below.
  • SonicWall lists the workaround as “None.” The sources read provide no exploit-specific indicators.

Actionable Intel

ArtifactTypeATT&CKLog SourceAction
SonicOS 7.3.4-7013Fixed buildT1078Firewall inventoryFor SAML-enabled SSL-VPN on Gen7 TZ, NSa, NSsp, and NSv at 7.3.3-7015 or earlier, install SonicOS 7.3.4-7013 or a higher vendor-supported version. SNWLID-2026-0014.
SonicOS 8.2.3-8015Fixed buildT1078Firewall inventoryFor SAML-enabled SSL-VPN on Gen8 TZ, NSa, and NSv at 8.2.2-8015 or earlier, install SonicOS 8.2.3-8015 or a higher vendor-supported version. SNWLID-2026-0014.

Detection

SourceRuleGap
Splunk ESCUNot checkedReviewer access required SAML SSO; no negative-coverage claim.
ElasticPartial — First Seen SonicWall Remote Access Login by User and SourceMisses a known source and does not compare an IdP event.
SigmaNot checkedAdjacent URI rule read; behavior-wide absence not established.

Detection index: Elastic 0aacc5e (logic read); SigmaHQ 53b90df (adjacent rule only); ESCU reviewer check unavailable. Mirrors not refreshed by reviewer.

Hunt hint: Collect SonicWall Enhanced Syslog and query event.code=1080 AND event.action="login-success". Select user.name values required by policy to use SAML. Group by observer.serial_number, user.name, and source.ip, then compare each success with IdP sign-ins for the same identity within five minutes. Investigate missing IdP matches after checking clock skew, retention, and IdP session reuse. Check the raw authentication message for an alternate login method and trace the assigned tunnel address into internal traffic. This is a reviewer-proposed correlation, not a vendor exploit signature.

Sources: CISA KEV alert, 6 November · CISA KEV JSON · CISA on X · SNWLID-2026-0014 · BleepingComputer · SecurityWeek

Status Updates

  • OpenSSH (OpenSSH-CVE-2026-123158): GreyNoise reports five successful chains on vulnerable gridpoints since 6 Nov 4:46 PM PST; watchTowr independently reports botnets/miners. Scope remains musl with PAM disabled; not in KEV. GreyNoise watchTowr 6 Nov brief
  • WordPress Core (WordPress-Core-CVE-2026-119977): KEV’s 6 November deadline has passed. Before updating, deny /wp-content/upgrade/ in server config or use RedirectMatch 403 ^/wp-content/upgrade/ in root .htaccess; verify 403. The upgrade-dir .htaccess is deleted; wp core update uses the same updater. Picus 4 Nov brief
  • Synology DSM (Cerber-Synology-DSM-2026-10): No new material: Synology still has not identified which of CVE-2024-10441, CVE-2024-50629 or CVE-2024-10445 was used. Qihoo’s different CVE attribution remains a separate claim, not vendor confirmation. Synology 2 Nov brief
  • European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): Unit 42 summarizes the 1–2 November wave and French reports of affected medical facilities. Initial access and hacktivist claims remain unconfirmed. Its 5,000+ devices are exposed, not confirmed compromised. Unit 42 2 Nov brief
  • ARTEX (ARTEX-Software-Vendors-2026-11): WorkOS now attributes its incident to a researcher’s escaped test agent, not a malicious cluster. Microsoft publishes four ARTEX server IPs; its new Storm-3358 campaign claim is deferred pending another origin. WorkOS Microsoft 3 Nov brief
  • Retired from watch: Linux kernel Fragnesia CVE-2026-46300 (last update 2026-10-29); LiteLLM 1.107.0 (LiteLLM-1.107.0-2026-10, last update 2026-10-24). 29 Oct brief 22 Oct brief
  • Ivanti Connect Secure CVE-2026-111357: Watching (no change). KEV overdue; prior correction remains in force. Prior brief
  • SharePoint ToolShell (Storm2603-ToolShell-Fileless-2026-11): Watching (no change). CVE-2025-53770 is KEV overdue; CVE-2025-53771 is not in KEV. Prior brief
  • Siemens Software Center (Siemens-Software-Center-CVE-2026-110936): Watching (no change). CVE-2026-110936 is KEV overdue. Prior brief
  • Plex Media Server (Plex2Shell-CVE-2026-96652): Watching (no change). CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 remain KEV overdue. Prior brief
  • BeyondTrust Remote Support CVE-2026-102764: Watching (no change). KEV overdue; retire-eligible 8 November if quiet. Prior brief
  • GitLab CVE-2026-97229: Watching (no change). KEV overdue. Prior brief
  • Cisco ASA and FTD CVE-2026-76418: Watching (no change). KEV overdue; retire-eligible 8 November if quiet. Prior brief
  • Ruby Onigmo (Ruby-Onigmo-2026-10-23): Watching (no change). CVE-2026-97229 remains KEV overdue; CVE-2026-89078, CVE-2026-93577 and CVE-2026-110264 on this entry are not in KEV. Prior brief
  • PHP core (PHP2Shell-CVE-2026-109618): Watching (no change). CVE-2026-109618 and CVE-2026-109619 remain KEV overdue; CVE-2026-115560 is not in KEV. Prior brief
  • Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 November. Prior brief
  • Ivanti Connect Secure CVE-2026-118527: Watching (no change). KEV remains due 13 November. Prior brief
  • VMware ESX CVE-2026-41709: Watching (no change). KEV remains due 11 November. Prior brief
  • Brotli CVE-2026-111497: Watching (no change). KEV remains due 10 November. Prior brief
  • Adobe Commerce CVE-2026-48356: Watching (no change). KEV remains due 10 November. Prior brief
  • Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). Prior brief
  • GitLab CVE-2026-110264: Watching (no change). Prior brief
  • Canonical LXD CVE-2026-112816: Watching (no change). Prior brief
  • Binance (Binance-TraderTraitor-2026-11): Watching (no change). Prior brief
  • eMudhra (eMudhra-CVE-2026-111943): Watching (no change). CVE-2026-111943 and CVE-2026-91403: no change. Prior brief
  • Tailscale SSH (Tailworm-Tailscale-SSH-2026-10): Watching (no change). Prior brief
  • Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10): Watching (no change). Prior brief
  • XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). Prior brief
  • WinRAR Gorbag (Gorbag-WinRAR-CVE-2025-8088-2026-11): Watching (no change). CVE-2025-8088: no change. Prior brief